{"id":"1819945c439fb753","repo":"rust-lang/cargo","slug":"failed-to-verify-the-checksum-of-181994","errorCode":null,"errorMessage":"failed to verify the checksum of `{}`","messagePattern":"failed to verify the checksum of `(.+?)`","errorType":"exception","errorClass":"anyhow::Error","httpStatus":null,"severity":"error","filePath":"src/sources/registry/local.rs","lineNumber":196,"sourceCode":"        let path = self.root.join(&pkg.tarball_name()).into_path_unlocked();\n        let mut crate_file = paths::open(&path)?;\n\n        // If we've already got an unpacked version of this crate, then skip the\n        // checksum below as it is in theory already verified.\n        let dst = path.file_stem().unwrap();\n        if self.src_path.join(dst).into_path_unlocked().exists() {\n            return Ok(MaybeLock::Ready(crate_file));\n        }\n\n        if !self.quiet {\n            self.gctx.shell().status(\"Unpacking\", pkg)?;\n        }\n\n        // We don't actually need to download anything per-se, we just need to\n        // verify the checksum matches the .crate file itself.\n        let actual = Sha256::new().update_file(&crate_file)?.finish_hex();\n        if actual != checksum {\n            anyhow::bail!(\"failed to verify the checksum of `{}`\", pkg)\n        }\n\n        crate_file.seek(SeekFrom::Start(0))?;\n\n        Ok(MaybeLock::Ready(crate_file))\n    }\n\n    async fn finish_download(\n        &self,\n        _pkg: PackageId,\n        _checksum: &str,\n        _data: &[u8],\n    ) -> CargoResult<File> {\n        panic!(\"this source doesn't download\")\n    }\n}\n","sourceCodeStart":178,"sourceCodeEnd":213,"githubUrl":"https://github.com/rust-lang/cargo/blob/0e07a155371a6ce88ae53a2c00df940280c09a67/src/sources/registry/local.rs#L178-L213","documentation":"Identical invariant to error 166 but for a *local* registry: `LocalRegistry::download` (src/sources/registry/local.rs:194) computes the SHA-256 of the on-disk `.crate` file and compares to the checksum from the index. A mismatch means the `.crate` blob on disk doesn't match what the index says it should be. (Cargo skips this check only when the unpacked source is already present.)","triggerScenarios":"A local-registry `.crate` file was modified, truncated, or replaced with a different version than the index declares; an index that lists the wrong checksum; a partially-copied registry tree.","commonSituations":"Manual edits to a vendored registry; a sync/copy that left a half-written `.crate`; mismatched index + crate versions after a partial `git pull` of the registry; registry generation tooling that computes checksums incorrectly.","solutions":["Re-fetch or re-copy the offending `.crate` file so its bytes match the index checksum.","Recompute the correct SHA-256 of the file and update the index entry if the file is authoritative.","Regenerate the whole local registry from a trusted source/tool to ensure index and blobs agree."],"exampleFix":"# verify and reconcile\nsha256sum my-registry/foo-1.0.0.crate\n# compare to checksum in my-registry/index/fo/o/foo\n# replace the file or fix the index to match","handlingStrategy":"validation","validationCode":"// For a local registry, verify each .crate matches its indexed checksum before use.\nfn verify_local_crate(crate_file: &Path, expected_sha256: &str) -> bool {\n    let actual = sha256_file(crate_file);  // hex string\n    actual == expected_sha256\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Don't hand-edit `.crate` files or the index.","Regenerate the whole local registry from a trusted source if any checksum mismatches."],"tags":["cargo","registry","local-registry","checksum","security"],"analyzedSha":"0e07a155371a6ce88ae53a2c00df940280c09a67","analyzedAt":"2026-08-06T01:46:58.334Z","schemaVersion":2}